Authentication vulnerability in App Builder – Create Native Android & iOS Apps On The Flight 5.3.7

A popular tool for creating apps, called The App Builder, has a security issue that could allow someone to gain more privileges than they should have. This is because of two functions called verify_otp_forgot_password() and update_password(), which don’t have enough protection to stop someone from guessing the right code to change a password or to confirm a password reset request from a real user. This means that someone who isn’t logged in could figure out the code and change the password for any user, including the main administrator.